WebSockets in ASP.NET 4.5

[ERR!]
added by kalyanms1
10/3/2011 9:17:12 AM

507 Views

This post discuss about using WebSockets in ASP.NET 4.5. You can read this post to get an understanding about WebSockets. This post shows piece of code which uses WebSockets in ASP.NET 4.5 and the code is related to simple chat application.

Read the full story
ASP.NET
4 comments
dpeterson
10/3/2011 9:17:56 AM
I think WebSockets are the thing I am most excited about when it comes to HTML5. The level of interactivity available in web applications is going to get a big boost as soon as browser support is ubiquitous, or at least close enough to it.
vijayst
10/4/2011 4:12:00 PM
This is a good article that walks through the steps to create a chat application using HTML5 WebSocket and ASP.NET 4.5 support for WebSocket request. Will using WebSocket create security vulnerabilities? - Any browser can open a WebSocket request with the server.
dpeterson
10/4/2011 4:20:05 PM
Changing the url from ws:// to wss:// will enable ssl encryption. It's up to you to implement authentication at the application level, as well as deciding how to handle malformed messages. But at the very least, with ssl, you can be relatively sure that data is not being sniffed and no man-in-the-middle attacks are going on.
vijayst
10/4/2011 5:35:46 PM
Even with wss://, since the URL and code is exposed directly in javascript, it is easier to send legitimate messages to the server. Also, the web server could be flooded with WebSocket requests. I will be curious to know the request lifecycle works with WebSocket requests.
dpeterson
10/4/2011 5:42:49 PM
Well, the url would always be exposed, whether we're talking websockets or not ;-)
If someone sends message to the server, the server must first check for an active authentication. If there is none, it doesn't matter what types of message are sent as the application should drop them. SSL protects the authentication process as well as the messages sent so that authentication tokens cannot be intercepted. Enabling SSL really is the cornerstone of implementing any real security in a web application, whether websockets or normal https protocols are used for transport.